From 7c9de241319b2623f058b41921cd14e6387864d7 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:00:26 +0000
Subject: [PATCH 1/2] fix(deps): update dependency js-yaml to v5

---
 package-lock.json | 10 +++++-----
 package.json      |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a8c0799..d37dcd4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,7 +13,7 @@
         "@types/jsonwebtoken": "^9.0.10",
         "dotenv": "^17.0.0",
         "express": "^5.0.0",
-        "js-yaml": "^4.3.2",
+        "js-yaml": "^5.0.0",
         "jsonwebtoken": "^9.0.2",
         "zod": "^4.0.0"
       },
@@ -732,9 +732,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
       "funding": [
         {
           "type": "github",
@@ -750,7 +750,7 @@
         "argparse": "^2.0.1"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
     "node_modules/jsonwebtoken": {
diff --git a/package.json b/package.json
index c6ec010..f2f47e6 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
     "@types/jsonwebtoken": "^9.0.10",
     "dotenv": "^17.0.0",
     "express": "^5.0.0",
-    "js-yaml": "^4.3.2",
+    "js-yaml": "^5.0.0",
     "jsonwebtoken": "^9.0.2",
     "zod": "^4.0.0"
   },

From 541fc1c32723eb8f6e9a384029c7bc05aa906a94 Mon Sep 17 00:00:00 2001
From: mldangelo <michael.l.dangelo@gmail.com>
Date: Thu, 8 Oct 2026 05:32:25 -0400
Subject: [PATCH 2/2] fix: preserve model allowlist YAML merge keys

---
 package-lock.json           | 7 -------
 package.json                | 1 -
 src/utils/litellm-config.ts | 6 ++++--
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7b6ce80..8bd0941 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,6 @@
       "version": "1.0.0",
       "license": "UNLICENSED",
       "dependencies": {
-        "@types/js-yaml": "^4.0.9",
         "@types/jsonwebtoken": "^9.0.10",
         "dotenv": "^17.0.0",
         "express": "^5.0.0",
@@ -146,12 +145,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@types/js-yaml": {
-      "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
-      "integrity": "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==",
-      "license": "MIT"
-    },
     "node_modules/@types/jsonwebtoken": {
       "version": "9.0.10",
       "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
diff --git a/package.json b/package.json
index f2f47e6..6f5b629 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,6 @@
   "author": "",
   "license": "UNLICENSED",
   "dependencies": {
-    "@types/js-yaml": "^4.0.9",
     "@types/jsonwebtoken": "^9.0.10",
     "dotenv": "^17.0.0",
     "express": "^5.0.0",
diff --git a/src/utils/litellm-config.ts b/src/utils/litellm-config.ts
index f9834d7..c5e53a8 100644
--- a/src/utils/litellm-config.ts
+++ b/src/utils/litellm-config.ts
@@ -25,7 +25,10 @@ export function getAllowedModels(): string[] {
   try {
     const configPath = path.join(process.cwd(), 'litellm_config.yaml');
     const fileContents = fs.readFileSync(configPath, 'utf8');
-    const config = yaml.load(fileContents) as LiteLLMConfig;
+    // Keep supporting YAML merge keys used to share LiteLLM model settings.
+    const config = yaml.load(fileContents, {
+      schema: yaml.CORE_SCHEMA.withTags(yaml.mergeTag),
+    }) as LiteLLMConfig;
 
     // Extract model names from model_list
     const models: string[] = [];
@@ -56,4 +59,3 @@ export function isModelAllowed(model: string): boolean {
   const allowed = getAllowedModels();
   return allowed.length === 0 || allowed.includes(model);
 }
-